Yes, technically you can host the digital product passport for steel yourself. The regulation does not specify which party must store or present the data. What it does specify are requirements for how long the passport must remain accessible, in which format, and how reliable the link to the QR code must be. These requirements apply regardless of who does the hosting — yourself, an IT department, or an external party.
The question is therefore less "may I do it myself" and more "can I do it myself, and for how long". A product passport that must remain accessible for ten years often survives multiple server changes, a couple of IT supplier changes and possibly a business acquisition in practice. That is a different task than a website you put online this year.
What the regulation requires, regardless of who does the hosting
The core is always the same: the passport must be retrievable via the QR code for the prescribed period, the data must match what was known at the time of recording, and it must be traceable where the information comes from. Supervisors look at the outcome — is the passport accessible and correct — not at the technology used to achieve that. That makes self-hosting possible in principle, but it shifts all responsibility for that outcome to you.
Anyone considering this would do well to first read what is precisely laid down about traceability and retention period. On how the data becomes a passport it is explained which steps are involved, from initial entry to the link with the QR carrier.
Where self-hosting ends and outsourcing begins
Creating the first version of a passport is often still manageable for a technically skilled company: collecting data, choosing a format, generating a QR code. Where it becomes more difficult is with everything that comes after. A server that must be online without interruption for ten years requires maintenance, backups and a plan for when your current hosting package provider stops or goes bankrupt. A change in the format prescribed by the regulation must be detected and implemented by you. And if your company changes name, is taken over, or ceases operations, there must be someone to keep the QR codes of all delivered steel products working.
That last point is the turning point for many SMEs. Maintaining your own server for the duration of one project is different from guaranteeing that a QR code placed on a batch of steel profiles today will still point to the correct data in eight years — even if your company no longer exists in the same way then. That is precisely why some companies deliberately outsource the hosting to a party that is structurally set up for this, while keeping data collection and legal content in-house.
Questions you can ask yourself before you decide
For those considering self-hosting, a few questions are useful: who in your organisation will still be responsible for this technology in ten years, what happens to the QR codes if your company changes ownership, and is there a backup copy of the data outside your own system. None of these questions has a legally binding answer — the regulation leaves the interpretation free — but they do determine whether self-hosting is practically sustainable.
The cost side also plays a role. Maintaining your own server, security and maintenance for ten years has a price that is not always immediately visible, because it only adds up over the longer term. An overview of what hosting via an external party costs is on the pricing page, so you can weigh that against your own estimate.
Anyone who is unsure whether self-hosting makes sense for their own situation will find in the knowledge base with elaborated topics per situation more background on the requirements for retention period and accessibility. For your own, specific situation, it remains advisable to consult the official text or ask a lawyer.
Would you first like to see where your company stands before making a choice between doing it yourself and outsourcing? Take the free product scan with a few short questions and get an immediate indication.